arch/x86/pti.rst

1 .. SPDX-License-Identifier: GPL-2.0
27 This approach helps to ensure that side-channel attacks leveraging
30 Once enabled at compile-time, it can be disabled at boot with the
31 'nopti' or 'pti=' kernel parameters (see kernel-parameters.txt).
36 When PTI is enabled, the kernel manages two sets of page tables.
43 that any missed kernel->user CR3 switch will immediately crash
49 each CPU's copy of the area a compile-time-fixed virtual address.
65 Protection against side-channel attacks is important.  But,
70   a. Each process now needs an order-1 PGD instead of order-0.
86      non-PTI SYSCALL entry code, so requires mapping fewer
91      feature of the MMU allows different processes to share TLB
93      TLB misses after a context switch.  The actual loss of
95   d. Process Context IDentifiers (PCID) is a CPU feature that
96      allows us to skip flushing the entire TLB when switching page
101      and kernel entries out of the TLB.  The user PCID TLB flush is
106      are created by copying top-level (PGD) entries into each
111   f. In addition to the fork()-time copying, there must also
117      the entire TLB.  That means that each syscall, interrupt
118      or exception flushes the TLB.
119   h. INVPCID is a TLB-flushing instruction which allows flushing
120      of TLB entries for non-current PCIDs.  Some systems support
122      can only be flushed from the TLB for the current PCID.  When
124      single kernel address flush will require a TLB-flushing CR3
132    boot-time switching.
147    frequent performance monitoring non-maskable interrupts (see "NMI"
150    interrupted, including nested NMIs.  Using "-c" boosts the rate of
151    NMIs, and using two -c with separate counters encourages nested NMIs
155 	while true; do perf record -c 10000 -e instructions,cycles -a sleep 10; done
158 5. Run 32-bit binaries on systems supporting the SYSCALL instruction.
159    This has been a lightly-tested code path and needs extra scrutiny.
186    faults upon page faults.  Caused by touching non-pti-mapped
188    CR3 before calling into C functions which are not pti-mapped.
191    tended to be TLB invalidation issues.  Usually invalidating